@smthrs/platform-node 0.0.0-stage → 1.0.0-rc.4

package/dist/esm/NodeHost.d.ts

@@ -0,0 +1,145 @@
+/**
+ * Aggregate Node.js Host bundle.
+ *
+ * This module defines the `NodeHost` service union and a single `layer` that
+ * provides the closed Host surface backed by Node: `@effect/platform-node`'s
+ * filesystem, child-process spawner, Undici `HttpClient`, native `Path`,
+ * and the Node `Jj` adapter from its own package. Use the layer when a Node
+ * program wants every host capability from one place; use the individual
+ * modules when a program should only be able to reach part of the host. The
+ * bundle also supplies native `ProcessConfinement` for the kernel spawner.
+ *
+ * There is no Node HTTP module either: outgoing requests are Effect's
+ * `HttpClient`, and `@effect/platform-node` already ships the Undici-backed
+ * implementation. Undici follows no redirect unless a redirect interceptor is
+ * installed, so every hop stays visible to `@smthrs/kernel`'s decorator.
+ *
+ * There is no Node shell module: running a command is Effect's
+ * `ChildProcessSpawner`, and `@effect/platform-node` already ships the
+ * implementation.
+ *
+ * @since 0.1.0
+ */
+import * as NodeChildProcessSpawner from "../vendor/node/NodeChildProcessSpawner.js";
+import * as NodeCrypto from "../vendor/node/NodeCrypto.js";
+import * as NodeFileSystem from "../vendor/node/NodeFileSystem.js";
+import * as NodeHttpClient from "../vendor/node/NodeHttpClient.js";
+import type { Jj, JjError } from "@smthrs/jj";
+import type { HostServiceIds } from "@smthrs/kernel/HostServices";
+import type * as KernelProcessConfinement from "@smthrs/kernel/ProcessConfinement";
+import type * as ProcessLedger from "@smthrs/kernel/ProcessLedger";
+import type { FileSystem } from "effect/FileSystem";
+import * as Layer from "effect/Layer";
+import type * as Path from "effect/Path";
+import * as Schema from "effect/Schema";
+import type { HttpClient } from "effect/unstable/http/HttpClient";
+import type { ChildProcessSpawner } from "effect/unstable/process/ChildProcessSpawner";
+import * as AtomicFileSystem from "./AtomicFileSystem.ts";
+import * as EgressHttpClient from "./EgressHttpClient.ts";
+import * as ProcessReaper from "./ProcessReaper.ts";
+/**
+ * The Node platform modules Effect ships, re-exported so a program that wants
+ * only part of the host has one place to reach for them. `NodeJj` belongs to
+ * `@smthrs/jj`; import it from there.
+ *
+ * `NodeCrypto` is here for a different reason than the rest. `Crypto` is not a
+ * Host service — it carries no host authority the kernel could attenuate, so
+ * it is not in {@link NodeHost} and not in the closed list — but every durable
+ * composition needs one, and a program that already depends on this package
+ * for its host should not have to add a second dependency for the digest.
+ *
+ * @category re-exports
+ * @since 0.1.0
+ */
+export { AtomicFileSystem, EgressHttpClient, NodeChildProcessSpawner, NodeCrypto, NodeFileSystem, NodeHttpClient, ProcessReaper };
+/**
+ * The union of host services provided by the Node host layer.
+ *
+ * @category models
+ * @since 0.1.0
+ */
+export type NodeHost = FileSystem | Path.Path | ChildProcessSpawner | Jj | HttpClient | KernelProcessConfinement.ProcessConfinement;
+declare const NodeHostError_base: Schema.Class<NodeHostError, Schema.TaggedStruct<"@smthrs/platform-node/NodeHostError", {
+    readonly code: Schema.Literal<"invalid_repository_root">;
+    readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * Invalid repository-root configuration, refused before layer construction.
+ * @category errors
+ * @since 1.0.0-rc.0
+ */
+export declare class NodeHostError extends NodeHostError_base {
+    readonly name = "NodeHostError";
+}
+/**
+ * Stable implementation identities for the raw bundle's five Host slots.
+ * Contained POSIX factories replace its spawner with {@link ProcessReaper.layerSpawner}.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export declare const implementationIds: Readonly<Record<(typeof HostServiceIds)[number], string>>;
+/**
+ * What a caller may configure about a contained Node host.
+ *
+ * `platform` is deliberately absent. `ContainedSpawner.Options` declares it so a
+ * caller that supplies its own spawner can describe one, but this native host
+ * detaches by `process.platform` whatever a record claims. A caller-supplied
+ * `"win32"` on a POSIX host would therefore
+ * record `pgid: null` for a child that really does lead a group, and
+ * {@link ProcessReaper.reap} would retire that record as `no-group` and leave
+ * the orphan running forever — a durable lie rather than a compile error.
+ *
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export type ContainedOptions = ProcessReaper.SpawnerOptions & ProcessReaper.Options;
+/**
+ * Provides the default Node implementations for the whole closed Host surface.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layer: Layer.Layer<NodeHost, JjError>;
+/**
+ * Provides the Node host with `Jj` bound to one absolute repository root.
+ *
+ * @category layers
+ * @since 1.0.0
+ */
+export declare const layerAt: (repositoryRoot: string) => Layer.Layer<NodeHost, JjError>;
+/**
+ * Provides the Node host with process containment turned on.
+ *
+ * The difference from {@link layer} is what happens to a spawned process when
+ * its run stops. Under {@link layer} a child is signalled when its scope
+ * closes and then waited for, forever if it ignores `SIGTERM`, and a host that
+ * dies without closing its scopes abandons every child it started. This layer
+ * gives each child an escalation deadline and records it in the
+ * `ProcessLedger`, then sweeps the records a previous incarnation of the same
+ * host left behind before it hands the host over
+ * ({@link ProcessReaper.reap}).
+ *
+ * jj is contained here too: `layerContained` builds the `Jj` service over the
+ * same spawner rather than letting it start its own children, so a `jj`
+ * invocation a crashed host left running is a record the next incarnation
+ * reaps like any other.
+ *
+ * The ledger is a requirement rather than a default because the durable half
+ * of containment is only as good as the journal underneath it:
+ * `ProcessLedger.layer` inherits a crashed incarnation's processes,
+ * `ProcessLedger.layerMemory` contains this incarnation and nothing more, and
+ * the choice belongs to the program that knows which it has.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export declare const layerContained: (options?: ContainedOptions) => Layer.Layer<NodeHost, JjError, ProcessLedger.ProcessLedger>;
+/**
+ * Provides the contained Node host with `Jj` bound to one absolute repository
+ * root.
+ *
+ * @category layers
+ * @since 1.0.0
+ */
+export declare const layerContainedAt: (repositoryRoot: string, options?: ContainedOptions) => Layer.Layer<NodeHost, JjError, ProcessLedger.ProcessLedger>;
+//# sourceMappingURL=NodeHost.d.ts.map

package/dist/esm/NodeHost.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NodeHost.d.ts","sourceRoot":"","sources":["../../src/NodeHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,uBAAuB,MAAM,+CAA+C,CAAA;AACxF,OAAO,KAAK,UAAU,MAAM,kCAAkC,CAAA;AAC9D,OAAO,KAAK,cAAc,MAAM,sCAAsC,CAAA;AACtE,OAAO,KAAK,cAAc,MAAM,sCAAsC,CAAA;AAEtE,OAAO,KAAK,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAE7C,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAA;AACjE,OAAO,KAAK,KAAK,wBAAwB,MAAM,mCAAmC,CAAA;AAClF,OAAO,KAAK,KAAK,aAAa,MAAM,8BAA8B,CAAA;AAClE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AACrC,OAAO,KAAK,KAAK,IAAI,MAAM,aAAa,CAAA;AACxC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AACvC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAA;AACjE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6CAA6C,CAAA;AAEtF,OAAO,KAAK,gBAAgB,MAAM,uBAAuB,CAAA;AACzD,OAAO,KAAK,gBAAgB,MAAM,uBAAuB,CAAA;AAEzD,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACvB,UAAU,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACd,CAAA;AAcD;;;;;GAKG;AACH,MAAM,MAAM,QAAQ,GAChB,UAAU,GACV,IAAI,CAAC,IAAI,GACT,mBAAmB,GACnB,EAAE,GACF,UAAU,GACV,wBAAwB,CAAC,kBAAkB,CAAA;;;;;AAE/C;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,kBAGjC;IACA,SAAkB,IAAI,mBAAkB;CACzC;AAYD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAMvF,CAAA;AAKD;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,gBAAgB,GAAG,aAAa,CAAC,cAAc,GAAG,aAAa,CAAC,OAAO,CAAA;AAQnF;;;;;GAKG;AACH,eAAO,MAAM,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAMhD,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,OAAO,GAAI,gBAAgB,MAAM,KAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAO3E,CAAA;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,cAAc,GACzB,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,aAAa,CAgB5D,CAAA;AAED;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,GAC3B,gBAAgB,MAAM,EACtB,UAAU,gBAAgB,KACzB,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,EAAE,aAAa,CAAC,aAAa,CAW5D,CAAA"}

package/dist/esm/NodeHost.js

@@ -0,0 +1,162 @@
+/**
+ * Aggregate Node.js Host bundle.
+ *
+ * This module defines the `NodeHost` service union and a single `layer` that
+ * provides the closed Host surface backed by Node: `@effect/platform-node`'s
+ * filesystem, child-process spawner, Undici `HttpClient`, native `Path`,
+ * and the Node `Jj` adapter from its own package. Use the layer when a Node
+ * program wants every host capability from one place; use the individual
+ * modules when a program should only be able to reach part of the host. The
+ * bundle also supplies native `ProcessConfinement` for the kernel spawner.
+ *
+ * There is no Node HTTP module either: outgoing requests are Effect's
+ * `HttpClient`, and `@effect/platform-node` already ships the Undici-backed
+ * implementation. Undici follows no redirect unless a redirect interceptor is
+ * installed, so every hop stays visible to `@smthrs/kernel`'s decorator.
+ *
+ * There is no Node shell module: running a command is Effect's
+ * `ChildProcessSpawner`, and `@effect/platform-node` already ships the
+ * implementation.
+ *
+ * @since 0.1.0
+ */
+import * as NodeChildProcessSpawner from "../vendor/node/NodeChildProcessSpawner.js";
+import * as NodeCrypto from "../vendor/node/NodeCrypto.js";
+import * as NodeFileSystem from "../vendor/node/NodeFileSystem.js";
+import * as NodeHttpClient from "../vendor/node/NodeHttpClient.js";
+import * as NodePath from "../vendor/node/NodePath.js";
+import * as NodeJj from "@smthrs/jj/node/NodeJj";
+import * as Layer from "effect/Layer";
+import * as Schema from "effect/Schema";
+import { isAbsolute } from "node:path";
+import * as AtomicFileSystem from "./AtomicFileSystem.js";
+import * as EgressHttpClient from "./EgressHttpClient.js";
+import * as ProcessConfinement from "./ProcessConfinement.js";
+import * as ProcessReaper from "./ProcessReaper.js";
+/**
+ * The Node platform modules Effect ships, re-exported so a program that wants
+ * only part of the host has one place to reach for them. `NodeJj` belongs to
+ * `@smthrs/jj`; import it from there.
+ *
+ * `NodeCrypto` is here for a different reason than the rest. `Crypto` is not a
+ * Host service — it carries no host authority the kernel could attenuate, so
+ * it is not in {@link NodeHost} and not in the closed list — but every durable
+ * composition needs one, and a program that already depends on this package
+ * for its host should not have to add a second dependency for the digest.
+ *
+ * @category re-exports
+ * @since 0.1.0
+ */
+export { AtomicFileSystem, EgressHttpClient, NodeChildProcessSpawner, NodeCrypto, NodeFileSystem, NodeHttpClient, ProcessReaper };
+/**
+ * The `HttpClient` every bundle below installs: Undici through the egress
+ * proxy this process's environment names, and a direct Undici pool when it
+ * names none.
+ *
+ * `NodeHttpClient.layerUndici` is the direct pool unconditionally. It is still
+ * re-exported above for a program composing its own services, but a bundle
+ * that spans a whole host has to work inside a sandbox whose only way out is a
+ * proxy, so the bundles read the environment. See {@link EgressHttpClient}.
+ */
+const httpClient = EgressHttpClient.layer(process.env);
+/**
+ * Invalid repository-root configuration, refused before layer construction.
+ * @category errors
+ * @since 1.0.0-rc.0
+ */
+export class NodeHostError extends Schema.TaggedError()("@smthrs/platform-node/NodeHostError", {
+    code: Schema.Literal("invalid_repository_root"),
+    message: Schema.String
+}) {
+    name = "NodeHostError";
+}
+const absoluteRoot = (root) => {
+    if (isAbsolute(root))
+        return root;
+    throw new NodeHostError({
+        code: "invalid_repository_root",
+        message: `NodeHost requires an absolute repository root, got ${JSON.stringify(Array.from(root).slice(0, 64).join(""))}`
+    });
+};
+/**
+ * Stable implementation identities for the raw bundle's five Host slots.
+ * Contained POSIX factories replace its spawner with {@link ProcessReaper.layerSpawner}.
+ * @category models
+ * @since 1.0.0-rc.0
+ */
+export const implementationIds = {
+    "effect/FileSystem": "@smthrs/platform-node/AtomicFileSystem",
+    "effect/Path": "@effect/platform-node/NodePath",
+    "effect/process/ChildProcessSpawner": "@effect/platform-node/NodeChildProcessSpawner",
+    "@smthrs/jj/Jj": "@smthrs/jj/node/NodeJj",
+    "effect/HttpClient": "@smthrs/platform-node/EgressHttpClient"
+};
+/** The two services `NodeChildProcessSpawner` resolves paths and files with. */
+const platform = Layer.mergeAll(AtomicFileSystem.layer, NodePath.layer);
+/** The reaper half of {@link ContainedOptions}. */
+const reaping = (options) => ({
+    ownerPid: options?.ownerPid,
+    system: options?.system
+});
+/**
+ * Provides the default Node implementations for the whole closed Host surface.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layer = Layer.mergeAll(ProcessConfinement.layer(), platform, Layer.provide(NodeChildProcessSpawner.layer, platform), httpClient, NodeJj.layer);
+/**
+ * Provides the Node host with `Jj` bound to one absolute repository root.
+ *
+ * @category layers
+ * @since 1.0.0
+ */
+export const layerAt = (repositoryRoot) => Layer.mergeAll(ProcessConfinement.layer(), platform, Layer.provide(NodeChildProcessSpawner.layer, platform), httpClient, NodeJj.layerAt(absoluteRoot(repositoryRoot)));
+/**
+ * Provides the Node host with process containment turned on.
+ *
+ * The difference from {@link layer} is what happens to a spawned process when
+ * its run stops. Under {@link layer} a child is signalled when its scope
+ * closes and then waited for, forever if it ignores `SIGTERM`, and a host that
+ * dies without closing its scopes abandons every child it started. This layer
+ * gives each child an escalation deadline and records it in the
+ * `ProcessLedger`, then sweeps the records a previous incarnation of the same
+ * host left behind before it hands the host over
+ * ({@link ProcessReaper.reap}).
+ *
+ * jj is contained here too: `layerContained` builds the `Jj` service over the
+ * same spawner rather than letting it start its own children, so a `jj`
+ * invocation a crashed host left running is a record the next incarnation
+ * reaps like any other.
+ *
+ * The ledger is a requirement rather than a default because the durable half
+ * of containment is only as good as the journal underneath it:
+ * `ProcessLedger.layer` inherits a crashed incarnation's processes,
+ * `ProcessLedger.layerMemory` contains this incarnation and nothing more, and
+ * the choice belongs to the program that knows which it has.
+ *
+ * @category layers
+ * @since 0.1.0
+ */
+export const layerContained = (options) => {
+    const spawner = Layer.provide(ProcessReaper.layerSpawner({ graceMs: options?.graceMs }), Layer.provide(NodeChildProcessSpawner.layer, platform));
+    return Layer.mergeAll(ProcessConfinement.layer(), platform, httpClient, 
+    // jj goes through the CONTAINED spawner here, not around it. `NodeJj.layer`
+    // spawns its own children, which is right for a host that has no spawner
+    // to offer, but under containment it would mean a `jj` that leads no
+    // recorded process group, appears in no ledger, and survives the
+    // incarnation that started it.
+    Layer.provideMerge(NodeJj.layerSpawner, spawner)).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))));
+};
+/**
+ * Provides the contained Node host with `Jj` bound to one absolute repository
+ * root.
+ *
+ * @category layers
+ * @since 1.0.0
+ */
+export const layerContainedAt = (repositoryRoot, options) => {
+    const spawner = Layer.provide(ProcessReaper.layerSpawner({ graceMs: options?.graceMs }), Layer.provide(NodeChildProcessSpawner.layer, platform));
+    return Layer.mergeAll(ProcessConfinement.layer(), platform, httpClient, Layer.provideMerge(NodeJj.layerSpawnerAt(absoluteRoot(repositoryRoot)), spawner)).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))));
+};
+//# sourceMappingURL=NodeHost.js.map

package/dist/esm/NodeHost.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"NodeHost.js","sourceRoot":"","sources":["../../src/NodeHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,uBAAuB,MAAM,+CAA+C,CAAA;AACxF,OAAO,KAAK,UAAU,MAAM,kCAAkC,CAAA;AAC9D,OAAO,KAAK,cAAc,MAAM,sCAAsC,CAAA;AACtE,OAAO,KAAK,cAAc,MAAM,sCAAsC,CAAA;AACtE,OAAO,KAAK,QAAQ,MAAM,gCAAgC,CAAA;AAE1D,OAAO,KAAK,MAAM,MAAM,wBAAwB,CAAA;AAKhD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAErC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;AAGvC,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,gBAAgB,MAAM,uBAAuB,CAAA;AACzD,OAAO,KAAK,gBAAgB,MAAM,uBAAuB,CAAA;AACzD,OAAO,KAAK,kBAAkB,MAAM,yBAAyB,CAAA;AAC7D,OAAO,KAAK,aAAa,MAAM,oBAAoB,CAAA;AAEnD;;;;;;;;;;;;;GAaG;AACH,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,uBAAuB,EACvB,UAAU,EACV,cAAc,EACd,cAAc,EACd,aAAa,EACd,CAAA;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,GAAG,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;AAgBtD;;;;GAIG;AACH,MAAM,OAAO,aAAc,SAAQ,MAAM,CAAC,WAAW,EAAiB,CAAC,qCAAqC,EAAE;IAC5G,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,yBAAyB,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC,MAAM;CACvB,CAAC;IACkB,IAAI,GAAG,eAAe,CAAA;CACzC;AAED,MAAM,YAAY,GAAG,CAAC,IAAY,EAAU,EAAE;IAC5C,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IACjC,MAAM,IAAI,aAAa,CAAC;QACtB,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,sDACP,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CACvD,EAAE;KACH,CAAC,CAAA;AACJ,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA8D;IAC1F,mBAAmB,EAAE,wCAAwC;IAC7D,aAAa,EAAE,gCAAgC;IAC/C,oCAAoC,EAAE,+CAA+C;IACrF,eAAe,EAAE,wBAAwB;IACzC,mBAAmB,EAAE,wCAAwC;CAC9D,CAAA;AAED,gFAAgF;AAChF,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAA;AAkBvE,mDAAmD;AACnD,MAAM,OAAO,GAAG,CAAC,OAA0B,EAAyB,EAAE,CAAC,CAAC;IACtE,QAAQ,EAAE,OAAO,EAAE,QAAQ;IAC3B,MAAM,EAAE,OAAO,EAAE,MAAM;CACxB,CAAC,CAAA;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,KAAK,GAAmC,KAAK,CAAC,QAAQ,CACjE,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,KAAK,CAAC,OAAO,CAAC,uBAAuB,CAAC,KAAK,EAAE,QAAQ,CAAC,EACtD,UAAU,EACV,MAAM,CAAC,KAAK,CACb,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,cAAsB,EAAkC,EAAE,CAChF,KAAK,CAAC,QAAQ,CACZ,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,KAAK,CAAC,OAAO,CAAC,uBAAuB,CAAC,KAAK,EAAE,QAAQ,CAAC,EACtD,UAAU,EACV,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,CAC7C,CAAA;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,CAC5B,OAA0B,EACmC,EAAE;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAC3B,aAAa,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EACzD,KAAK,CAAC,OAAO,CAAC,uBAAuB,CAAC,KAAK,EAAE,QAAQ,CAAC,CACvD,CAAA;IACD,OAAO,KAAK,CAAC,QAAQ,CACnB,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,UAAU;IACV,4EAA4E;IAC5E,yEAAyE;IACzE,qEAAqE;IACrE,iEAAiE;IACjE,+BAA+B;IAC/B,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO,CAAC,CACjD,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;AACnE,CAAC,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAC9B,cAAsB,EACtB,OAA0B,EACmC,EAAE;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAC3B,aAAa,CAAC,YAAY,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EACzD,KAAK,CAAC,OAAO,CAAC,uBAAuB,CAAC,KAAK,EAAE,QAAQ,CAAC,CACvD,CAAA;IACD,OAAO,KAAK,CAAC,QAAQ,CACnB,kBAAkB,CAAC,KAAK,EAAE,EAC1B,QAAQ,EACR,UAAU,EACV,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC,EAAE,OAAO,CAAC,CACjF,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,aAAa,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAA;AACnE,CAAC,CAAA","sourcesContent":["/**\n * Aggregate Node.js Host bundle.\n *\n * This module defines the `NodeHost` service union and a single `layer` that\n * provides the closed Host surface backed by Node: `@effect/platform-node`'s\n * filesystem, child-process spawner, Undici `HttpClient`, native `Path`,\n * and the Node `Jj` adapter from its own package. Use the layer when a Node\n * program wants every host capability from one place; use the individual\n * modules when a program should only be able to reach part of the host. The\n * bundle also supplies native `ProcessConfinement` for the kernel spawner.\n *\n * There is no Node HTTP module either: outgoing requests are Effect's\n * `HttpClient`, and `@effect/platform-node` already ships the Undici-backed\n * implementation. Undici follows no redirect unless a redirect interceptor is\n * installed, so every hop stays visible to `@smthrs/kernel`'s decorator.\n *\n * There is no Node shell module: running a command is Effect's\n * `ChildProcessSpawner`, and `@effect/platform-node` already ships the\n * implementation.\n *\n * @since 0.1.0\n */\n\nimport * as NodeChildProcessSpawner from \"@effect/platform-node/NodeChildProcessSpawner\"\nimport * as NodeCrypto from \"@effect/platform-node/NodeCrypto\"\nimport * as NodeFileSystem from \"@effect/platform-node/NodeFileSystem\"\nimport * as NodeHttpClient from \"@effect/platform-node/NodeHttpClient\"\nimport * as NodePath from \"@effect/platform-node/NodePath\"\nimport type { Jj, JjError } from \"@smthrs/jj\"\nimport * as NodeJj from \"@smthrs/jj/node/NodeJj\"\nimport type { HostServiceIds } from \"@smthrs/kernel/HostServices\"\nimport type * as KernelProcessConfinement from \"@smthrs/kernel/ProcessConfinement\"\nimport type * as ProcessLedger from \"@smthrs/kernel/ProcessLedger\"\nimport type { FileSystem } from \"effect/FileSystem\"\nimport * as Layer from \"effect/Layer\"\nimport type * as Path from \"effect/Path\"\nimport * as Schema from \"effect/Schema\"\nimport type { HttpClient } from \"effect/unstable/http/HttpClient\"\nimport type { ChildProcessSpawner } from \"effect/unstable/process/ChildProcessSpawner\"\nimport { isAbsolute } from \"node:path\"\nimport * as AtomicFileSystem from \"./AtomicFileSystem.ts\"\nimport * as EgressHttpClient from \"./EgressHttpClient.ts\"\nimport * as ProcessConfinement from \"./ProcessConfinement.ts\"\nimport * as ProcessReaper from \"./ProcessReaper.ts\"\n\n/**\n * The Node platform modules Effect ships, re-exported so a program that wants\n * only part of the host has one place to reach for them. `NodeJj` belongs to\n * `@smthrs/jj`; import it from there.\n *\n * `NodeCrypto` is here for a different reason than the rest. `Crypto` is not a\n * Host service — it carries no host authority the kernel could attenuate, so\n * it is not in {@link NodeHost} and not in the closed list — but every durable\n * composition needs one, and a program that already depends on this package\n * for its host should not have to add a second dependency for the digest.\n *\n * @category re-exports\n * @since 0.1.0\n */\nexport {\n  AtomicFileSystem,\n  EgressHttpClient,\n  NodeChildProcessSpawner,\n  NodeCrypto,\n  NodeFileSystem,\n  NodeHttpClient,\n  ProcessReaper\n}\n\n/**\n * The `HttpClient` every bundle below installs: Undici through the egress\n * proxy this process's environment names, and a direct Undici pool when it\n * names none.\n *\n * `NodeHttpClient.layerUndici` is the direct pool unconditionally. It is still\n * re-exported above for a program composing its own services, but a bundle\n * that spans a whole host has to work inside a sandbox whose only way out is a\n * proxy, so the bundles read the environment. See {@link EgressHttpClient}.\n */\nconst httpClient = EgressHttpClient.layer(process.env)\n\n/**\n * The union of host services provided by the Node host layer.\n *\n * @category models\n * @since 0.1.0\n */\nexport type NodeHost =\n  | FileSystem\n  | Path.Path\n  | ChildProcessSpawner\n  | Jj\n  | HttpClient\n  | KernelProcessConfinement.ProcessConfinement\n\n/**\n * Invalid repository-root configuration, refused before layer construction.\n * @category errors\n * @since 1.0.0-rc.0\n */\nexport class NodeHostError extends Schema.TaggedError<NodeHostError>()(\"@smthrs/platform-node/NodeHostError\", {\n  code: Schema.Literal(\"invalid_repository_root\"),\n  message: Schema.String\n}) {\n  override readonly name = \"NodeHostError\"\n}\n\nconst absoluteRoot = (root: string): string => {\n  if (isAbsolute(root)) return root\n  throw new NodeHostError({\n    code: \"invalid_repository_root\",\n    message: `NodeHost requires an absolute repository root, got ${\n      JSON.stringify(Array.from(root).slice(0, 64).join(\"\"))\n    }`\n  })\n}\n\n/**\n * Stable implementation identities for the raw bundle's five Host slots.\n * Contained POSIX factories replace its spawner with {@link ProcessReaper.layerSpawner}.\n * @category models\n * @since 1.0.0-rc.0\n */\nexport const implementationIds: Readonly<Record<(typeof HostServiceIds)[number], string>> = {\n  \"effect/FileSystem\": \"@smthrs/platform-node/AtomicFileSystem\",\n  \"effect/Path\": \"@effect/platform-node/NodePath\",\n  \"effect/process/ChildProcessSpawner\": \"@effect/platform-node/NodeChildProcessSpawner\",\n  \"@smthrs/jj/Jj\": \"@smthrs/jj/node/NodeJj\",\n  \"effect/HttpClient\": \"@smthrs/platform-node/EgressHttpClient\"\n}\n\n/** The two services `NodeChildProcessSpawner` resolves paths and files with. */\nconst platform = Layer.mergeAll(AtomicFileSystem.layer, NodePath.layer)\n\n/**\n * What a caller may configure about a contained Node host.\n *\n * `platform` is deliberately absent. `ContainedSpawner.Options` declares it so a\n * caller that supplies its own spawner can describe one, but this native host\n * detaches by `process.platform` whatever a record claims. A caller-supplied\n * `\"win32\"` on a POSIX host would therefore\n * record `pgid: null` for a child that really does lead a group, and\n * {@link ProcessReaper.reap} would retire that record as `no-group` and leave\n * the orphan running forever — a durable lie rather than a compile error.\n *\n * @category models\n * @since 1.0.0-rc.0\n */\nexport type ContainedOptions = ProcessReaper.SpawnerOptions & ProcessReaper.Options\n\n/** The reaper half of {@link ContainedOptions}. */\nconst reaping = (options?: ContainedOptions): ProcessReaper.Options => ({\n  ownerPid: options?.ownerPid,\n  system: options?.system\n})\n\n/**\n * Provides the default Node implementations for the whole closed Host surface.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layer: Layer.Layer<NodeHost, JjError> = Layer.mergeAll(\n  ProcessConfinement.layer(),\n  platform,\n  Layer.provide(NodeChildProcessSpawner.layer, platform),\n  httpClient,\n  NodeJj.layer\n)\n\n/**\n * Provides the Node host with `Jj` bound to one absolute repository root.\n *\n * @category layers\n * @since 1.0.0\n */\nexport const layerAt = (repositoryRoot: string): Layer.Layer<NodeHost, JjError> =>\n  Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    Layer.provide(NodeChildProcessSpawner.layer, platform),\n    httpClient,\n    NodeJj.layerAt(absoluteRoot(repositoryRoot))\n  )\n\n/**\n * Provides the Node host with process containment turned on.\n *\n * The difference from {@link layer} is what happens to a spawned process when\n * its run stops. Under {@link layer} a child is signalled when its scope\n * closes and then waited for, forever if it ignores `SIGTERM`, and a host that\n * dies without closing its scopes abandons every child it started. This layer\n * gives each child an escalation deadline and records it in the\n * `ProcessLedger`, then sweeps the records a previous incarnation of the same\n * host left behind before it hands the host over\n * ({@link ProcessReaper.reap}).\n *\n * jj is contained here too: `layerContained` builds the `Jj` service over the\n * same spawner rather than letting it start its own children, so a `jj`\n * invocation a crashed host left running is a record the next incarnation\n * reaps like any other.\n *\n * The ledger is a requirement rather than a default because the durable half\n * of containment is only as good as the journal underneath it:\n * `ProcessLedger.layer` inherits a crashed incarnation's processes,\n * `ProcessLedger.layerMemory` contains this incarnation and nothing more, and\n * the choice belongs to the program that knows which it has.\n *\n * @category layers\n * @since 0.1.0\n */\nexport const layerContained = (\n  options?: ContainedOptions\n): Layer.Layer<NodeHost, JjError, ProcessLedger.ProcessLedger> => {\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(NodeChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    httpClient,\n    // jj goes through the CONTAINED spawner here, not around it. `NodeJj.layer`\n    // spawns its own children, which is right for a host that has no spawner\n    // to offer, but under containment it would mean a `jj` that leads no\n    // recorded process group, appears in no ledger, and survives the\n    // incarnation that started it.\n    Layer.provideMerge(NodeJj.layerSpawner, spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n\n/**\n * Provides the contained Node host with `Jj` bound to one absolute repository\n * root.\n *\n * @category layers\n * @since 1.0.0\n */\nexport const layerContainedAt = (\n  repositoryRoot: string,\n  options?: ContainedOptions\n): Layer.Layer<NodeHost, JjError, ProcessLedger.ProcessLedger> => {\n  const spawner = Layer.provide(\n    ProcessReaper.layerSpawner({ graceMs: options?.graceMs }),\n    Layer.provide(NodeChildProcessSpawner.layer, platform)\n  )\n  return Layer.mergeAll(\n    ProcessConfinement.layer(),\n    platform,\n    httpClient,\n    Layer.provideMerge(NodeJj.layerSpawnerAt(absoluteRoot(repositoryRoot)), spawner)\n  ).pipe(Layer.provideMerge(ProcessReaper.layer(reaping(options))))\n}\n"]}

package/dist/esm/ProcessConfinement.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The kernel's `ProcessConfinement` seam, filled with this host's native
+ * sandbox: bubblewrap on Linux, seatbelt on macOS.
+ *
+ * `@smthrs/kernel`'s `ChildProcessSpawner.layer` hands every stage that passed
+ * its `proc:spawn` check to the confinement in its context, together with the
+ * `ProcessConfinement.Profile` the grants in force admit. This module turns
+ * that profile into a {@link ProcessSandbox.Request}, plans it against the
+ * workspace, and wraps the stage's argv in the mechanism the host has, so an
+ * approved `bash` can write only where an `fs:write` grant says and reach the
+ * network only when a `net:*` grant says. A stage that asked for the platform
+ * shell is spelled out as `/bin/sh -c <line>` first: wrapping a `shell: true`
+ * command line would otherwise leave its redirections and pipes to a shell
+ * outside the sandbox.
+ *
+ * A host with no mechanism is the one decision this module leaves to its
+ * caller: {@link Options.unavailable} either refuses the spawn, so nothing
+ * runs that the profile would not have confined, or runs it unconfined with
+ * a warning, the way every host did before this seam existed. A write set
+ * the mechanism cannot enforce safely, a symbolic link below the workspace
+ * root, is always refused.
+ *
+ * @since 1.0.0-rc.1
+ */
+import * as KernelProcessConfinement from "@smthrs/kernel/ProcessConfinement";
+import * as Layer from "effect/Layer";
+import * as ProcessSandbox from "./ProcessSandbox.ts";
+/**
+ * How the confinement is built.
+ *
+ * @category models
+ * @since 1.0.0-rc.1
+ */
+export interface Options {
+    /**
+     * What happens when this host has no mechanism to enforce a profile with.
+     * `"refuse"` fails the spawn, so a command never runs with more than the
+     * profile allows; `"unconfined"` runs it as given and logs a
+     * warning naming what the host lacks.
+     */
+    readonly unavailable?: "refuse" | "unconfined" | undefined;
+    /** The host facts mechanism selection reads; defaults to the real host. */
+    readonly host?: ProcessSandbox.Host | undefined;
+    /** Where each run's private temporary directory is created; defaults to the OS temporary directory. */
+    readonly temporaryDirectory?: string | undefined;
+}
+/**
+ * Builds the native confinement.
+ *
+ * @category constructors
+ * @since 1.0.0-rc.1
+ */
+export declare const make: (options?: Options) => KernelProcessConfinement.Service;
+/**
+ * Provides the native confinement.
+ *
+ * @category layers
+ * @since 1.0.0-rc.1
+ */
+export declare const layer: (options?: Options) => Layer.Layer<KernelProcessConfinement.ProcessConfinement>;
+//# sourceMappingURL=ProcessConfinement.d.ts.map

package/dist/esm/ProcessConfinement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProcessConfinement.d.ts","sourceRoot":"","sources":["../../src/ProcessConfinement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,wBAAwB,MAAM,mCAAmC,CAAA;AAE7E,OAAO,KAAK,KAAK,MAAM,cAAc,CAAA;AAOrC,OAAO,KAAK,cAAc,MAAM,qBAAqB,CAAA;AAErD;;;;;GAKG;AACH,MAAM,WAAW,OAAO;IACtB;;;;;OAKG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,GAAG,YAAY,GAAG,SAAS,CAAA;IAC1D,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,IAAI,GAAG,SAAS,CAAA;IAC/C,uGAAuG;IACvG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CACjD;AA0FD;;;;;GAKG;AACH,eAAO,MAAM,IAAI,GAAI,UAAS,OAAY,KAAG,wBAAwB,CAAC,OA2MrE,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,KAAK,GAAI,UAAS,OAAY,KAAG,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,kBAAkB,CAC1B,CAAA"}